admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
3ebca266e6dfd5c1908e447092a763cddd5a8d01
splunk-security_content/detections/experimental/endpoint
T
History
Lou Stella d3322283c3 Added risk_severity
2022-02-25 13:49:21 -06:00
..
.untested
detection/experimental folder for untested detections
2020-11-06 10:37:11 -08:00
child_processes_of_spoolsv_exe.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
detect_baron_samedit_cve_2021_3156_segfault.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
detect_baron_samedit_cve_2021_3156_via_osquery.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
detect_baron_samedit_cve_2021_3156.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
detect_computer_changed_with_anonymous_account.yml
The Unbroken Haag
2021-12-06 11:57:20 -07:00
detect_outlook_exe_writing_a_zip_file.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
detect_rare_executables.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
detection_of_tools_built_by_nirsoft.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
exchange_powershell_abuse_via_ssrf.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
exchange_powershell_module_usage.yml
Update exchange_powershell_module_usage.yml
2021-11-15 07:53:20 -07:00
first_time_seen_child_process_of_zoom.yml
The Unbroken Haag
2021-12-06 11:57:20 -07:00
first_time_seen_running_windows_service.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
macos___re_opened_applications.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml
updating docs and package bits [ci skip]
2022-01-14 02:07:36 +00:00
print_processor_registry_autostart.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
processes_tapping_keyboard_events.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
randomly_generated_scheduled_task_name.yml
fixing wrong data models
2022-01-18 15:48:01 -05:00
randomly_generated_windows_service_name.yml
fixing wrong data models
2022-01-18 15:48:01 -05:00
remote_desktop_process_running_on_system.yml
updating analytic story name
2021-12-06 17:01:58 -05:00
spike_in_file_writes.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
ssa___anomalous_usage_of_account_credentials.yml
updating docs and package bits [ci skip]
2022-01-31 20:04:12 +00:00
ssa___detect_kerberoasting.yml
excluding experimental detections from the package
2022-01-10 18:00:59 -05:00
ssa___disable_defender_antivirus_registry.yml
push
2022-02-07 14:45:37 -08:00
ssa___excessive_number_of_office_files_copied.yml
moving to match what prod should have
2022-01-21 12:29:13 -05:00
ssa___first_time_seen_cmd_line.yml
excluding experimental detections from the package
2022-01-10 18:00:59 -05:00
ssa___high_file_deletion_frequency.yml
moving to match what prod should have
2022-01-21 12:29:13 -05:00
ssa___rare_parent_process_relationship_lolbas.yml
excluding experimental detections from the package
2022-01-10 18:00:59 -05:00
ssa___windows_wsreset_uac_bypass.yml
Added risk_severity
2022-02-25 13:49:21 -06:00
sunburst_correlation_dll_and_network_event.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
suspicious_curl_network_connection.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
suspicious_plistbuddy_usage_via_osquery.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
suspicious_plistbuddy_usage.yml
CARS_UPDATE_MITRE_ID_B8
2021-10-15 10:22:43 +02:00
suspicious_sqlite3_lsquarantine_behavior.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
unusual_number_of_computer_service_tickets_requested.yml
fixing wrong data models
2022-01-18 15:48:01 -05:00
unusual_number_of_remote_endpoint_authentication_events.yml
updating docs and package bits [ci skip]
2022-01-21 21:02:48 +00:00
unusually_long_command_line___mltk.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
unusually_long_command_line.yml
excluding experimental detections from the package
2022-01-10 18:00:59 -05:00
windows_java_spawning_shells.yml
updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
winrm_spawning_a_process.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
wmi_permanent_event_subscription.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00
wmi_temporary_event_subscription.yml
add analytic types to detections
2021-07-19 17:41:22 +02:00